Because the Commonwealth of Pennsylvania does not have a comprehensive consumer privacy law, it relies on a patchwork of other laws and regulations to protect its citizens’ information from unwanted access, collection and use. Including Pennsylvania’s Wiretapping and Electronic Surveillance Control Act, 18 Pa. CS § 5701 onwards. (WESCA) is at the center of a recent decision resulting from a third-party marketing company’s covert interception of a consumer’s communications while she was shopping online.
Plaintiff Ashley Popa navigated to the Harriet Carter Gifts website on her iPhone to search for pet stairs. Popa ended up adding a set to her shopping cart and started the checkout process, but didn’t complete it. As she clicked through the site, Popa’s browser unsurprisingly communicated with Harriet Carter, but also secretly interacted with NaviStone, a third-party marketing service Harriet Carter hired. Popa left Harriet Carter’s website without buying anything, but not before NaviStone had sent a “OneTag” code to her browser, which allowed it to collect, among other things, pages Popa visited when she checked her email address entered and items she added to her shopping cart.
Popa filed a lawsuit in the Western District of Pennsylvania alleging that Harriet Carter and NaviStone violated WESCA and common law violations of privacy. (On appeal, the Third Circuit recognized that WESCA grants individuals a private right of action, meaning consumers can bring claims for alleged violations without waiting for state or regulatory action.) The district court quickly dismissed the privacy violation lawsuit and later entered summary judgment in favor of defendants with respect to the WESCA complaint. Popa appealed the Third Circuit’s dismissal of her WESCA lawsuit.
Third Circuit Appeals Process
The Third Circuit rejected the defendants’ main argument that Pennsylvania courts had exempted direct recipients of communications from WESCA’s guilt. In doing so, it noted that the inventories of criminal suppression cases relied on by the defendants were later codified in amendments to WESCA that protected law enforcement officials from liability for wiretapping when they are an “intended recipient” or identify themselves as an “intended recipient.” ” spend. It was noted that the Pennsylvania Legislature had the option, but refrained from adopting more expansive language to define intended recipients.
The Third Circuit found that the Pennsylvania Supreme Court would find that WESCA did not provide a comprehensive direct party exemption and that the defendants could not avoid liability because Popa’s browser “unknowingly communicated directly with NaviStone’s servers.” In a broader context, the Third Circuit acknowledged in footnote 6 that this conflicts with its view in cases brought under the Federal Wiretap Act, which contains an explicit exemption for direct parties. For example in Regarding Google Inc. Cookie Placement Consumer Privacy Litigation And Regarding Nickelodeon Consumer Privacy Disputesthe plaintiffs’ browsers sent GET requests directly to the defendants, turning them into parties to communications under the federal wiretapping law.
The Third Circuit then turned its attention to determining where NaviStone intercepted Popa’s communications, a critical question here because WESCA is not requesting conduct entirely outside of Pennsylvania. In other words, if the wiretapping took place in Virginia, where NaviStone’s servers are located, a court would have to conduct an electoral law analysis to determine whether WESCA made a request. The Third Circuit determined that NaviStone’s interception occurred in Popa’s browser, not where NaviStone was directing the communications. Although the parties believed the interception took place in Pennsylvania, the Third Circuit found no support in the records to determine where Popa’s browser met Harrier Carter’s website and where NaviStone’s code began instructing their browser to use his servers to communicate.
The Third Circuit remanded the case to the district court to determine if there is a genuine issue of material fact as to where the interception took place.
The father The opinion underscores the need for Pennsylvania businesses and digital marketing companies offering services in the Commonwealth to obtain consumer consent before collecting their data or installing cookies on a browser. It is also emphasized that courts will give broad meaning to what is “interception” of a communication under WESCA. This could set a precedent for similar cases in court pending enactment of a comprehensive privacy law in the Commonwealth of Pennsylvania.